Hacker News Reader

Comment by IvanAchlaqullah | Hacker News Reader

> Imagine tax software (comercial or gov provided) refusing to work unless you use an OS with TPM support for "security reasons".

> I don't think this will happen any time soon (hopefully) but I can see how even making your own hardware might no be enough.

This already happened in Android, at least where I lives (Indonesia). Most of Banks, Government Services, and freaking McDonald's apps will refuse to run if your phone are rooted "for security reason".

View on HN

Honest question: how do those apps know your phone is rooted, and can you still use their websites for equivalent functionality?

Google provides attestation and it's a constant cat-and-mouse game that the rooters are usually losing.

Websites can't tell, but lots of companies don't provide equivalent functionality via website. I know I can't upload check images for remote deposit unless I use the native banking app.

It's called SafetyNet [1]

What irked me is sometime app developers are abusing it without asking themself "Does this app really need to check for rooted phones at all?"

I'm okay if banks apps are using that. But why does fast foods apps need to use that? Most people that I know are paying with cash when they order foods online (and you can't hack paper money with rooted android phones).

[1] https://developer.android.com/training/safetynet/attestation

probably becomes a tick on an auditor's checklist

like having to rotate your password every 3 weeks and requiring 4 special characters/...

Platforms like deliveroo have lost tens of millions to fraud, I don’t blame them for enforcing safetynet.

Perhaps “food delivery” means pizza to you, but there are many places where it also includes thousand dollar bottles of wine.

Could you explain how the locked-down phone is protection against fraud here?

Statistically people who do payment fraud crap use rooted phones more, probably to help with things like location spoofing to get around other fraud detection methods when apps use third party payment libraries, so you reduce your fraud cost with something that is a few lines of code. The cost/benefit ratio is too good which is why you see it everywhere that has a payment fraud risk of some sort.

This way they can permanently ban your device. Fraud detection stuff works better too, but it’s mostly about the first.

Fraud becomes significantly less profitable and more of a pain in the ass if you need to set up a new phone for each account.

Here's a question I'd love for Google to answer: why do you need their special blessing to be able to make a file manager app, but not an app that uses SafetyNet?

> I'm okay if banks apps are using that.

I'm not okay with it, to be honest. It's my money, and I trust a rooted LineageOS with it much more than I trust the default firmware of most phones. Besides, my bank lets you do the same operations from their website that you can do with the app, so in my case it's pure inconvenience, not security.

The most popular root solutions have a "hide" feature so apps you specify can't tell you are rooted. It is slightly more complicated with custom roms.

I have Google Pay and several banking apps on my rooted phone without issue.

Does your phone pass hardware attestation?

Google can make it mandatory at any moment and then you won't be able to "hide" anything.

Presumably a website could support WebAuthn and require you log in using a "Platform Authenticator" like Windows Hello.[0] One way or another, websites will end up requiring that only "secure" devices access them (preferably disclosing a unique serial number registered to them).

[0] https://www.hypr.com/platform-authenticator/

Reply on news.ycombinator.com